{"id":"CVE-2026-88809","kind":"vulnerability","aliases":["CVE-2026-88809"],"related":[],"title":"SUSE Rancher Manager: authenticated users can make the server request destinations the /meta/proxy allowlist should block (SSRF)","description":"A security vulnerability exists in the SUSE Rancher Manager meta proxy endpoint (/meta/proxy). This endpoint is intended to forward requests only to  destinations that appear on a configured allowlist. The allowlist decision was evaluated in a  place where it could not stop a request from being forwarded, so a rejected destination was logged but the request was still handed to the proxy's transport. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and potentially older EOL versions.","summary":"Rancher Manager's /meta/proxy endpoint logs when a destination fails its allowlist check but still forwards the request anyway. An attacker who can reach the endpoint can make the Rancher server send requests to destinations the allowlist was meant to block.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"rancher","fixed":["2.11.19","2.12.15","2.13.11","2.14.7","2.15.3"],"affected":">=2.11.0 <2.11.19, >=2.12.0 <2.12.15, >=2.13.0 <2.13.11, >=2.14.0 <2.14.7, >=2.15.0 <2.15.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","kubernetes","rancher","self-hosted","ssrf"],"not_affected_if":["auth-required","managed-hosting","patched-version","version-outside-affected-ranges"],"how_to_check":"Check your Rancher Manager version. Affected: >=2.15.0 <2.15.3, >=2.14.0 <2.14.7, >=2.13.0 <2.13.11, >=2.12.0 <2.12.15, >=2.11.0 <2.11.19 (older EOL lines may be affected). Then check how Rancher is exposed: a direct path to Rancher (a pod in the local cluster reaching the Rancher Service, networkExposure.type none with an L4 load balancer, tls: external passthrough, hostPort/hostNetwork) leaves the endpoint reachable; the default Helm Ingress behind nginx, Traefik, Envoy or HAProxy blocks the needed request form. Logs show 'Failed to proxy:' for each attempt, but normal rejections log the same line, so logs cannot confirm abuse. Also check whether the Rancher server can reach cloud metadata (AWS IMDSv1).","fix":"Upgrade Rancher Manager to 2.15.3, 2.14.7, 2.13.11, 2.12.15 or 2.11.19 (matching your minor line). Server-side only, no breaking changes. If you suspect prior abuse, rotate credentials reachable from the Rancher server, including cloud instance-metadata credentials.","status":"open","published_at":"2026-11-02T16:17:44+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","triaged_at":"2026-11-02T16:26:36+00:00","updated_at":"2026-11-02T16:30:19+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-02T16:26:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SUSE Rancher Manager: /meta/proxy forwards requests to rejected destinations","impact":"medium","summary":"Rancher Manager's /meta/proxy endpoint logs when a destination fails its allowlist check but still forwards the request anyway. An attacker who can reach the endpoint can make the Rancher server send requests to destinations the allowlist was meant to block.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["rancher","kubernetes","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Rancher server forwards requests to disallowed destinations, enabling internal network access","analyst_note":"Find the vendor advisory (linked as 'Vendor advisory: github.com') to confirm the fixed versions, whether authentication is required, and what the allowlist protects.","how_to_check":"- Check the installed Rancher Manager version and compare it with the affected ranges: 2.15.0 to 2.15.3, 2.14.0 to 2.14.7, 2.13.0 to 2.13.11, 2.12.0 to 2.12.15, 2.11.0 to 2.11.19, and older EOL versions.\n- Look for the `/meta/proxy` endpoint on the Rancher server's exposed URL.\n- unknown for any further check: the sources do not say what a request to the endpoint looks like in logs.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges","managed-hosting"],"who_is_affected":"Teams running SUSE Rancher Manager in the affected version ranges are exposed, since the flaw is in the server's own proxy endpoint. The sources do not say whether a login is needed to reach /meta/proxy, so treat any reachable Rancher instance as in scope until that is confirmed. Teams on versions outside the listed ranges, or on managed hosting where the vendor runs Rancher, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000793,"input_tokens":4272,"output_tokens":732,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory (linked as 'Vendor advisory: github.com') to confirm the fixed versions, whether authentication is required, and what the allowlist protects.","search":"'-2026':19A,22A '-88809':20A,23A '/meta/proxy':13A,35B,85C '2.11.0':157C '2.11.19':160C '2.12.0':153C '2.12.15':156C '2.13.0':149C '2.13.11':152C '2.14.0':145C '2.14.7':148C '2.15.0':141C '2.15.3':144C 'affect':138C 'allowlist':14A,43B,68B,101C,103C 'anyway':50B 'appear':97C 'attack':52B 'authent':4A 'block':16A,72B 'check':44B 'configur':100C 'could':112C 'cve':18A,21A 'decis':104C 'destin':11A,40B,66B,95C,123C 'endpoint':36B,57B,84C,87C 'eol':164C 'evalu':106C 'exist':76C 'fail':41B 'forward':47B,91C,119C 'hand':131C 'host':30B 'infrastructur':25B 'intend':89C 'kubernet':26B 'log':37B,125C 'make':7A,59B 'manag':3A,33B,81C 'meant':70B 'meta':82C 'older':163C 'place':109C 'potenti':162C 'proxi':83C,134C 'rancher':2A,24A,27B,32B,61B,80C,140C 'reach':55B 'reject':122C 'request':10A,49B,64B,92C,116C,128C 'secur':74C 'self':29B 'self-host':28B 'send':63B 'server':9A,62B 'ssrf':17A,31B 'still':46B,130C 'stop':114C 'suse':1A,79C,139C 'transport':136C 'user':5A 'version':165C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted SUSE Rancher Manager in the affected ranges. The attacker must be an authenticated Rancher user (no admin rights needed) and must send an HTTP/1.1 request with the full destination URL in the request line that reaches Rancher without an HTTP-aware proxy rewriting it. Pods in the local cluster can always reach the Rancher Service directly, so an ingress controller is not a reliable control. Impact: reading internal services the Rancher server can reach, including cloud metadata credentials where IMDSv1 is on. Installs already on patched versions can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-02T16:30:19Z","by":"analyst","doc":"https://github.com/rancher/rancher/security/advisories/GHSA-f9gf-wh3x-jx3v","run_id":1399},"products":{"at":"2026-11-02T16:30:19Z","by":"analyst","doc":"https://github.com/rancher/rancher/security/advisories/GHSA-f9gf-wh3x-jx3v","run_id":1399},"mitigations":{"at":"2026-11-02T16:30:19Z","by":"analyst","doc":"https://github.com/rancher/rancher/security/advisories/GHSA-f9gf-wh3x-jx3v","run_id":1399},"workarounds":{"at":"2026-11-02T16:30:19Z","by":"analyst","doc":"https://github.com/rancher/rancher/security/advisories/GHSA-f9gf-wh3x-jx3v","run_id":1399},"how_to_check":{"at":"2026-11-02T16:30:19Z","by":"analyst","doc":"https://github.com/rancher/rancher/security/advisories/GHSA-f9gf-wh3x-jx3v","run_id":1399},"who_affected":{"at":"2026-11-02T16:30:19Z","by":"analyst","doc":"https://github.com/rancher/rancher/security/advisories/GHSA-f9gf-wh3x-jx3v","run_id":1399}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["rancher"],"ptokens":["rancher"],"labels":["high","infrastructure","kubernetes","rancher","selfhosted","ssrf"],"first_public_at":"2026-10-29T17:26:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N","cvss_by":"meissner@suse.de","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88809","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88809","severity":null,"published_at":"2026-11-02T16:17:44+00:00","modified_at":"2026-11-02T16:17:44+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","fetched_at":"2026-11-02T16:24:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-88809:1399","url":null,"severity":null,"published_at":"2026-11-02T16:30:19+00:00","modified_at":"2026-11-02T16:30:19+00:00","first_seen_at":"2026-11-02T16:30:19+00:00","fetched_at":"2026-11-02T16:30:19+00:00","note":"Read GHSA-f9gf-wh3x-jx3v. Fixed versions, auth required, workarounds (HTTP-aware proxy, NetworkPolicy, egress limits) confirmed from vendor text. No exploitation or PoC seen; did not search social."}],"documents":[{"id":52777,"url":"https://github.com/rancher/rancher/security/advisories/GHSA-f9gf-wh3x-jx3v","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T17:26:38+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}